Just about any of your employees could fall into this category under the influence of the hacker strategy of social engineering. Social engineering is the act of using inter-personal skills to get people to give away information that they otherwise wouldn’t. The implication is not widely understood, but yes, some hackers do have social skills.

Their methods can be quite ingenious. Perhaps a hacker notices on some hobby discussion board that a particular mid- to low-level employee is dialing up from an ISP instead of the usual IP block of your company. The hacker might then call an IT admin in the company pretending to be that worker, and explain that he is telecommuting today, his machine crashed and he’s having to reinstall, and he needs to know the VPN (Virtual Private Network) settings. Assuming a large organization and an admin that doesn’t know that employee’s voice very well, she just might give the information out.

The hacker might follow up by calling the main number of your company pretending to be a vendor and requesting to talk to a high-level manager. If the receptionist tells him that the manager is on vacation today, he can ask to leave a voicemail and try to subvert your phone system to send a voicemail on behalf of that manager. In the voicemail, he could tell a system administrator to create a new user account. With a VPN connection and a user account, he then has practically unfettered access to your systems.

That’s just one example. The important thing to take away from this is not the details, but the generalities. Hackers could go on a smoke break by the back door with your employees and sneak inside, then pretend to be a new hire in person. Consider a separate, unpublished phone number for telecommuter tech support. Make sure your phone system is secure. Have photo ID badges for all who are authorized to be in the building—and enforce it. And most importantly, you should train everyone in the company to not give out any information unless they are certain of whom they are talking to, lest they become unwitting victims of social engineering.

Scofflaw employees—that is, employees who want to bypass your normal security measures for their own convenience—can also be a huge problem.

The classic example of a scofflaw employee is one who ignores policy, bypasses the organization’s remote access mechanism, and decides to install a modem and PCAnywhere on her PC—many times without a reasonably good password. All of a sudden, there is an open door from the outside to your internal network—not a good thing.

Other examples include VIP users who do not want their Internet access to be monitored by IT. They therefore bypass corporate firewalls and dial into their own ISPs, which don’t necessarily have the same type of security policies as the organization.

As workstation-based Trojans become more common, bypassing a site’s security checkpoints becomes worse and worse. Consider AOL’s recent problem with a workstation-based trojan; hundreds of member accounts were compromised when employees executed an interesting-looking program that arrived by email:

These AOL employees were scofflaws in that they ignored an AOL policy: They opened executable content from untrusted sources because it looked less boring than the work that they were doing. Scofflaw users will become more and more of a threat as these types of Trojans proliferate. (See Chapter 18, “Trojans,” for more information.)

You can mitigate this risk somewhat by using desktop management tools to “lock down” the desktop—and in some organizations, this can in fact be appropriate— but in the end, it’s a policy problem, not a technology problem. Desktop management is only effective if the politics of an organization allow it to be.

Bottom line: Top-level management wouldn’t allow a VIP to erect a ladder on the side of the building to bypass corporate security’s checkpoints; it also should not allow anyone to bypass network security’s checkpoints. If top-level management truly understands the parallel, you have a powerful ally in the battle against scofflaws.

Of course, just because “everybody” is now a potential problem doesn’t mean that disgruntled IT workers and coders don’t have their own special set of concerns. More potential privileges mean more potential problems, naturally. Case in point is the oft-cited “logic bomb”:

System administrators and network infrastructure administrators can also be part of the problem—but they can also be part of the solution. If you have more than one hand in every pot, it’s a lot harder for one person to leave back doors, plant subversive code, and so on. That is, collaborative practices mean that systems and code are always subject to someone else’s review (see the next section, “Risk Mitigation Policies”)—which means that you can nip problems in the bud. (See also Chapter 13, “Logging Tools.”)

It’s actually pretty easy to practice due diligence with physical security. You’ve just got to be meticulous and consistent, and take it seriously. Pretend that someone could burglarize you personally if you’re not careful. It might help to pretend that you live in New York.

In all seriousness, physical security is where the battle can easily be lost—although it can’t be totally won with just physical safeguards. Little things like the capability to reboot a server from a floppy, or finding an unused username on a printout—or even finding a tape with a copy of a security database on it—make an intruder’s job easier. Let’s make it hard.

Here are some “dos” and “don’ts” that will make your job a little easier, an intruder’s life a little harder, and your data a little more secure:

Naturally, J. Random Hacker isn’t going to show up and reveal his otherworldly activities at a job interview. And even doing background checks can turn into nothing more than lip service, depending upon who’s doing the checks—and whether the individual has been caught in the past.

Still, there are things you can do to minimize your risks during the employment process. Start out by doing a “due diligence” background check—particularly for employees that will be involved in any level of IT. Do your homework and use a reputable agency to do your background checks—as with anything else in computing, “garbage in, garbage out.” If you are using an internal HR check or some other check that you don’t get invoiced for, communication is the key. Don’t assume that silence from your background check folks means “Everything is OK.” Lack of “NACK” (Negative ACKnowledgement) does not mean “ACK.” It might simply mean that your request form got thrown out with lunch’s pizza box. See http://www.nwc.com/1201/1201colfeldman.html for more discussion of the hiring process.

After you’ve worked with management to establish an Acceptable Use Policy, your next step is to work with HR to integrate it as part of the employment process for any employee. You want it integrated for two reasons: First, because it sends a message, and might dissuade an employee from snooping or fiddling where she doesn’t belong. Second, if termination or disciplinary action is necessary because of AUP violation, it’s definitely a lot easier to do if you have an “I-have-read-and-understood-this” AUP to back you up.

Lockdown, in the desktop management context, means that you’ve managed to apply the straps to your users in such a way that they can’t hurt themselves—or your network. In the best case, this is done in such a way that the users don’t feel constricted or stifled. Having a heart-to-heart with management about the level of lockdown can only be a good thing. Users get extremely irrational about losing any amount of autonomy, and you will definitely want management to buy into any lockdown that you need to enact.

It should be pointed out that desktop management—any desktop management—that resides on a local workstation can be bypassed by a clever user, unless there is serious physical security in place (no floppies, an “unpickable” case lock, and so forth). This, of course, is the type of security that you must have if you have public information terminals, kiosks, and so on. The point is that any workstation that isn’t physically secured can usually be booted from alternative media, and then the local OS can be modified to a malicious user’s heart’s content.

Still, desktop management and lockdown for nonpublic users are important due diligence measures, and definitely should not be skipped. The important thing here is to prevent either well-meaning or scofflaw users from hurting themselves and others. Defeating a truly noncasual and malicious user isn’t the primary purpose of desktop management.

Virus protection, of course, is a mandatory component to desktop management. Virus protection is (or should be) such second nature to today’s IT staff that we mention it here simply to ask one question: Can the user turn off virus protection?

Some virus protection suites let the user do this; others password-protect the entire control panel. You should certainly password-protect the control panel if possible, but you should also enact desktop management policies that check and re-install virus protection if the workstation’s otherwise permissive operating system allows its removal.

Good desktop management tools enable you to not only “force” certain applications, but they can also

It used to be that IT managers were only worried about what users were able to download; that is, folks were concerned about employee abuse of the Internet. At the time, there wasn’t technology to check what the actual downloaded content was—so managers contented themselves with blocking sites based upon where the user tried to surf. Certain software manufacturers also became service organizations (notably Cyber Patrol, discussed later in this chapter) that maintained a list of URLs in certain categories: adult-oriented, comedy, shopping, news, and so on. As a manager, you could then block various categories with a perimeter device that had access to these lists.

This strategy, however, wasn’t complete in and of itself. Objectionable sites surface overnight, and the list didn’t always reflect reality. And, filtering outbound URLS does nothing to fight questionable content that leaves your site.

Because one of the risks to your organization is the unauthorized disclosure of content (customer lists, intellectual property, and so on), one of the hottest topics in corporate security today is that of content management (also called content filtering, content services, and content restriction). Content management works in conjunction with your perimeter security devices. The software can perform lexical analysis, pattern matching—even image recognition. (Yes, those images.)

Another risk faced by your organization is the transmission of inappropriate content (pornographic, libelous, or otherwise offensive data) or dangerous content (such as Trojans and viruses) to business partners. You’d have to be nuts to think that any tool could totally eliminate the possibility of inappropriate content making it through your checkpoints. But content management tools can limit the possibility. Virus gateway protection software is one example of specialized content management.

Some vendors label their products as content filters, when in fact they are site filters or URL filters. Again, rather than checking the data stream for objectionable content, they check the Web address against a categorized list of known Web sites. Site filtering has merit. It can definitely decrease the amount of day trading/time-wasting/ non-work-related surfing at your organization—but it’s not content filtering. It is only as effective as the folks who update the lists. And, site management doesn’t do anything for your intranet.

That said, content management tools fall into two categories: those that offer generic content-checking services to the network, and those that operate solely on a specific application.

Those that offer generic content services tend to do it via CheckPoint Software’s CVP (Content Vectoring Protocol). CVP accepts a connection from a client, proxies the request to the server, scans the content, and either modifies or denies the request when content does not pass muster.

There is not yet an RFC-based content restriction protocol that has been widely implemented. If you’re not using Firewall-1 or another firewall that supports CVP, you might have to purchase individual products that separately monitor Web content (HTTP), email (SMTP), news (NNTP), and FTP.

You’ll also probably have to put up with some degree of false positives—yet another thing to administrate. For example, content filters commonly block Network Computing’s “Centerfold,” a showcase of innovative companies’ networks.

Still, content filters can be worthwhile, if you target and configure them correctly. See the section “Products,” later in this chapter for a sampling of content-filtering tools. Look for content management to change and grow in the next couple of years; hit the Web or magazines like Network Computing for the latest scoop.

At first, administrative collaboration doesn’t seem like much of a security practice. How can teamwork make your internal network a safer place?

First, consider that any illegal or unethical action involving partners automatically means that there are witnesses and possible leads to an investigation. As Benjamin Franklin said, “Three can keep a secret if two of them are dead.”

Secondly, take the case where there is no explicit partnership during a questionable activity. The fact that there is another administrator who has responsibility for the system involved means that the system itself is under scrutiny. The fact that there is third-party scrutiny of the system might discourage the perpetrator in the best case, or at least lead to discovery of the questionable activity.

You should be careful, however, to avoid assigning too many hands to any given pot. Not only can this lead to system chaos, but it also can make unethical activity harder to trace, either during an incident or an audit. You definitely want a limited pool of individuals accountable for a given system.

When a portable device walks away, it’s not pretty; the loss of the device is nothing compared to the potential loss of sensitive information. Although “password-at-power-up” is popular, it is not a good solution after someone has stolen your device; use real data encryption instead. There are a huge number of options, and it’s not our intention here to offer a complete buyer’s guide. Rather, this is a starting point. When you’re looking to buy portable device security solutions, consider the following points: